Virtual Event: Threat Detection and Incident Response Summit - Watch Sessions
Connect with us

Hi, what are you looking for?


Endpoint Security

Russian Hackers Claim Breach of Three U.S. Anti-Virus Companies

A high-profile hacking collective is offering for sale information allegedly stolen from three top anti-virus companies located in the United States, cybersecurity company Advanced Intelligence reveals. 

A high-profile hacking collective is offering for sale information allegedly stolen from three top anti-virus companies located in the United States, cybersecurity company Advanced Intelligence reveals. 

Operating under the moniker of Fxmsp, the threat actor appears to have a long-standing reputation of selling verifiable corporate breaches. Advanced Intelligence (AdvIntel) is confident that the hackers’ claims are credible and that past breaches brought them a profit close to $1 million.

The Russian- and English-speaking hacking collective, AdvIntel believes, has targeted high-profile global government and corporate entities to steal sensitive information. 

In March 2019, Fxmsp claimed to be in possession of information apparently stolen from top anti-virus companies in the U.S., including exclusive source code related to the companies’ software development. 

The actor is offering the stolen information and network access for over $300,000.

Fxmsp has operated in various top-tier Russian and English-speaking underground communities since 2017 and is believed to have established a network of trusted proxy resellers to promote their stolen data. 

Known for accessing network environments through externally available remote desktop protocol (RDP) servers and exposed active directory, the hackers also claim to have built a credential-stealing botnet capable to steal sensitive usernames and passwords from high-profile targets.

Advertisement. Scroll to continue reading.

In late April, the actor claimed to have secured access to three leading antivirus companies and to have extracted sensitive source code from antivirus software, AI, and security plugins. 

“Fxmsp also commented on the capabilities of the different companies’ software and assessed their efficiency,” AdvIntel says. 

The collective provided indicators to identify the company even when a seller is not disclosing its name and offered “screenshots of folders purported to contain 30 terabytes of data, which they allegedly extracted from these networks.”

The folders appear to contain information about development documentation, artificial intelligence model, web security software, and antivirus software base code, AdvIntel notes. 

The hackers claim to have focused on compromising the anti-virus companies for the last six months. This period falls in line with a period (October 2018 – April 2019) during which they maintained silence on underground forums where they normally post.

ShadowRunTeam, a high-profile Russian threat actor operating on Telegram, claims that Fxmsp is a Moscow resident named Andrey, who has been involved in cybercrime since mid-2000, and who is specialized in social engineering. 

“Our subject matter experts assess with high confidence that Fxmsp is a credible hacking collective that has a history of selling verifiable corporate breaches returning them profit close to $1,000,000,” AdvIntel notes. 

The company says it alerted law enforcement in the United States regarding the purported intrusions.

Related: Verizon Publishes 2019 Data Breach Investigations Report (DBIR)

Related: Finland to Investigate Suspected Nokia Chinese Data Breach

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content

Endpoint Security

Today, on January 10, 2023, Windows 7 Extended Security Updates (ESU) and Windows 8.1 have reached their end of support dates.

CISO Strategy

Varied viewpoints as related security concepts take on similar traits create substantial confusion among security teams trying to evaluate and purchase security technologies.

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Endpoint Security

The Zero Day Dilemma

Application Security

Password management firm LastPass says the hackers behind an August data breach stole a massive stash of customer data, including password vault data that...

Application Security

Microsoft on Tuesday pushed a major Windows update to address a security feature bypass already exploited in global ransomware attacks.The operating system update, released...

Endpoint Security

When establishing visibility and security controls across endpoints, security professionals need to understand that each endpoint bears some or all responsibility for its own...

Application Security

Electric car maker Tesla is using the annual Pwn2Own hacker contest to incentivize security researchers to showcase complex exploit chains that can lead to...